Win 2K with odd virus-like activity

My son got a file on the desktop with an icon that said TAG. The name of the file was Searchus.exe. Before I could stop him, he launched the file. Started getting tons of popups through IE. Even when IE wasn't launched. Started scrubbing the machine with several spyware and antivirus programs. Norton's antivirus was already installed when this happened. Currently I have only one remaining bug that I can't figure out. When booting up the machine, the message comes up to hit ctrl-alt-delete to login. (this is normal for this machine). After hitting ctrl-alt-del, and before the login screen appears, a blank window opens, with one character (like a pipe character) and a button on the bottom that says OK. If you don't click OK, you can't get to the login screen or proceed. To me, this implies that you are launching some rogue program before logging in. I can't figure out how to kill it or even what it is. Can anybody help?

 

first ensure that you have the windows 2000 sp4 installed
norton antivirus is not aimed at spyware
try running a program such as adware or spybot or whatever you like tor emove spyware
try being behind a router and see if that stops it
You might try running an online virus scan such as Trend housecall
check the startup
Windows 2000 is not the easiest to check and disable startup items

free utility

http://www.download.com/Startup-Inspector-for-Windows/3000-2086_4-10452094.html?tag=lst-7

go through the items one by one
if you are not sure google the term x spyware

you might want to dump norton
slows you to a crawl
send viruses to all your friends
only purpose is to reassure you and take cash from your wallet
anything else will do
avg free is fine

 

Running Housecall

I ran Housecall last night. Took a LONG time. I just let it run all night. It found several viruses. When I clicked Remove Infections (or whatever that button said) it popped up a window warning that some files are marked for deletion, not just disinfection. I clicked OK and all I got was right back to the previous screen. I clicked Remove Infections again and the scenario repeated itself. Housecall never actually cleaned or deleted any files. Had to go to work so I left. Will try more tonight. I wrote down the files it found and noted that the firewall I recently installed caught a downloader virus trying to download a file around midnight. The firewall denied and deleted it as it should have. At least something's going right.
Oh yeah, I recently deleted Active-X and Java when going through the machine looking for sources of the issue. Had to reinstall Java to run Housecall.